Which versions of D-Link are affected by CVE-2026-5024?

D-Link DIR-513 routers (v1.10) contain a stack-based buffer overflow in the email configuration interface that allows authenticated attackers to execute arbitrary code, compromising network…

Is there a public PoC exploit available for CVE-2026-5024?

Yes, a public proof-of-concept exploit is available for CVE-2026-5024. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-5024?

24 hours: Inventory all D-Link DIR-513 v1.10 devices in production and restrict network access to the administrative interface (typically port 80/443) via firewall rules or network segmentation. 7 days: Disable the email configuration feature on all affected devices if business operations permit, or migrate to supported router models from D-Link or alternative vendors. 30 days: Complete replacement of all D-Link DIR-513 units with current-generation, actively-supported networking equipment and validate administrative access is restricted to trusted networks only.

D-Link CVE-2026-5024

Q: What is the CVSS score of CVE-2026-5024?

CVE-2026-5024 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16969 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-03-29 VulDB

GHSA-f739-9xv4-c36c

D-Link Buffer Overflow Stack Overflow

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

Mar 30, 2026 - 19:00 vuln.today

Public exploit code

EUVD ID Assigned

Mar 29, 2026 - 03:30 euvd

EUVD-2026-16969

Analysis Generated

Mar 29, 2026 - 03:30 vuln.today

CVE Published

Mar 29, 2026 - 02:45 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

Stack-based buffer overflow in D-Link DIR-513 1.10 router's email configuration interface allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability affects the formSetEmail function via manipulation of the curTime parameter. Publicly available exploit code exists on GitHub, significantly lowering the exploitation barrier. CRITICAL LIMITATION: This product reached end-of-life and receives no security updates from D-Link, making this a permanent risk for deployed devices. CVSS 8.8 with low attack complexity and CVSS:3.1 Exploit Maturity 'Proof-of-Concept' confirms immediate exploitability.

Technical ContextAI

The vulnerability resides in the formSetEmail function within the /goform/formSetEmail endpoint of D-Link DIR-513 firmware version 1.10, a wireless router product. CWE-121 (Stack-based Buffer Overflow) indicates that user-controlled input to the 'curTime' parameter is copied to a fixed-size stack buffer without proper bounds checking. When excessive data is supplied, adjacent memory is overwritten, potentially including return addresses or function pointers. In embedded Linux devices like consumer routers, successful stack overflow exploitation typically allows attackers to redirect execution flow, execute shellcode, or invoke existing functions (ROP chains) to gain complete control over the device's operating system. The affected CPE (cpe:2.3:a:d-link:dir-513:*:*:*:*:*:*:*:*) confirms this targets the DIR-513 application firmware across all patch levels, with version 1.10 specifically identified.

RemediationAI

No vendor-released patch exists and none will be developed as D-Link DIR-513 has reached end-of-life with no ongoing security support (CVSS Remediation Level: X). The ONLY effective remediation is immediate hardware replacement with a currently supported router model from D-Link or another vendor that receives active security updates. INTERIM RISK REDUCTION measures for devices that cannot be immediately replaced: (1) Disable remote administration interfaces and ensure the web management interface is accessible only from trusted internal networks, not the internet; (2) Change all default credentials immediately to strong unique passwords; (3) Implement network segmentation to isolate DIR-513 devices from critical assets; (4) Monitor logs for unusual authentication attempts or configuration changes to the /goform/formSetEmail endpoint; (5) Consider placing the device behind a more secure firewall or gateway that can filter malicious requests. Organizations should reference D-Link's end-of-life policy at https://www.dlink.com/ and prioritize budget for hardware lifecycle management. The public exploit repository at https://github.com/Litengzheng/vul_db/blob/main/Dir513/vul_30/README.md should be reviewed to understand attack indicators for detection purposes only.